Comment by edpin2000

Ah, but Clova handles that. It locks to the domain, not the sender or the subdomain. So both your examples would still be allowed (citi.com and bankofamerica.com). There are also permanent inboxes in the system, which allow anyone. The trick is to delete them after a while when they get polluted with spam.